vxlan: fix use-after-free on deletion

Adding a vxlan interface to a socket isn't symmetrical, while adding
is done in vxlan_open() the deletion is done in vxlan_dellink().
This can cause a use-after-free error when we close the vxlan
interface before deleting it.

We add vxlan_vs_del_dev() to match vxlan_vs_add_dev() and call
it from vxlan_stop() to match the call from vxlan_open().

Orabug: 29755932

Fixes: 56ef9c9 ("vxlan: Move socket initialization to within rtnl scope")
Acked-by: Jiri Benc <[email protected]>
Tested-by: Roi Dayan <[email protected]>
Signed-off-by: Mark Bloch <[email protected]>
Acked-by: Roopa Prabhu <[email protected]>
Signed-off-by: David S. Miller <[email protected]>
(cherry picked from commit a53cb29)

Reviewed-by: Rama Nichanamatlu <[email protected]>
Signed-off-by: Venkat Venkatsubra <[email protected]>
Signed-off-by: Brian Maly <[email protected]>

Conflicts:
	drivers/net/vxlan.c

Signed-off-by: Brian Maly <[email protected]>

Author: mark-bloch

drivers/net/vxlan.c

@@ -76,6 +76,8 @@ static const u8 all_zeros_mac[ETH_ALEN];
 
 static int vxlan_sock_add(struct vxlan_dev *vxlan);
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan);
+
 /* per-network namespace private data for this module */
 struct vxlan_net {
 	struct list_head  vxlan_list;
@@ -1052,6 +1054,8 @@ static void vxlan_sock_release(struct vxlan_dev *vxlan)
 
 	synchronize_net();
 
+	vxlan_vs_del_dev(vxlan);
+
 	if (ipv4) {
 		udp_tunnel_sock_release(vxlan->vn4_sock->sock);
 		kfree(vxlan->vn4_sock);
@@ -2171,6 +2175,15 @@ static void vxlan_cleanup(unsigned long arg)
 	mod_timer(&vxlan->age_timer, next_timer);
 }
 
+static void vxlan_vs_del_dev(struct vxlan_dev *vxlan)
+{
+	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);
+
+	spin_lock(&vn->sock_lock);
+	hlist_del_init_rcu(&vxlan->hlist);
+	spin_unlock(&vn->sock_lock);
+}
+
 static void vxlan_vs_add_dev(struct vxlan_sock *vs, struct vxlan_dev *vxlan)
 {
 	struct vxlan_net *vn = net_generic(vxlan->net, vxlan_net_id);